[ci] Build the documented way in clean containers, so the README's build cannot silently rot

[geisten]

A build that only ever runs on the maintainers' machines drifts. Two bugs shipped that way and were found by hand.

Background

Running the README's own commands in clean containers turned up:

• mk/detect-target.sh had a bash shebang and produced an empty TARGET on images without bash — the build died pointing at mk/target-.mk.
• -std=c23 defines __STRICT_ANSI__, under which musl hides strdup. CI was green only because the release workflow passed EXTRA_CFLAGS=-D_GNU_SOURCE, a flag the documentation never mentioned. make lib was broken for anyone on musl following the README.

Both are fixed. Nothing stops them coming back.

Proposal

Add a CI job that builds the documented way — make lib, no extra flags — in clean containers:

image	expectation
debian:13 (gcc 14)	green
alpine:3.21 (gcc 14, musl)	green
ubuntu:24.04 (gcc 13)	expected to fail on -std=c23; assert the failure, or install gcc-14 and build with CC=gcc-14

A matrix over container: in .github/workflows/ci.yml covers it. The existing musl jobs are a close template — the difference that matters is that this job must pass no flags the README does not, which is the whole point.

Done when

• The job runs on every PR and fails if a plain make lib breaks on any listed image.
• Deliberately reintroducing either bug (restore the bash shebang, or drop -D_GNU_SOURCE from mk/target-linux.mk) makes the job red. Say in the PR that you checked this — a gate nobody has watched fail is a gate nobody knows works.
• The README's compiler prerequisites and the images tested here agree.